Skip to main content
Cookie Gate
a promotional graphic telling you that PCI Compliance is no longer an annual exercise and that continuous monitory must be built in
Category: Deceptive Design Patterns

Bundled Consent

Also known as: Consent Bundling, Bundled Requests for Consent
Simply put

Bundled consent is when an organization groups several separate requests to use your data into a single, take-it-or-leave-it consent, so you cannot agree to some purposes while refusing others. In the cookie context, this might mean asking you to accept analytics, advertising, and functional cookies all at once rather than choosing between them. This practice is generally discouraged or not permitted under several data privacy laws, which typically expect people to have genuine, granular choice.

Formal definition

Bundled consent refers to a single consent request that combines multiple distinct collections, uses, or disclosures of personal data, requiring an individual to accept them together rather than granting or withholding consent for each purpose separately. In EU and UK data protection practice, this conflicts with the requirement that consent be specific and freely given, since combining purposes deprives the data subject of granular control; the ICO frames valid consent as requiring genuine choice and control, which bundling can undermine. For cookie consent management, avoiding bundling generally means separating consent by cookie category or processing purpose (for example, analytics versus advertising) so that consent for one is not conditioned on consent for another. Note that the acceptability of bundling depends on the applicable legal regime, the specific purposes involved, and evolving regulatory guidance; the evidence here reflects general principles and Australian regulator descriptions rather than a definitive cross-jurisdictional rule, and detailed treatment under specific US state laws is out of scope for this entry.

Why it matters

Bundled consent sits at the heart of what many data protection regimes consider valid, meaningful consent. Under EU and UK data protection practice, consent must be freely given and specific, and the ICO frames valid consent as requiring genuine choice and control over how personal data is used. When an organization combines several distinct purposes, for example analytics, advertising, and functional cookies, into a single take-it-or-leave-it request, it can deprive individuals of that granular control, which is precisely why consent bundling is generally discouraged or not permitted under a number of data privacy laws.

For teams managing cookie consent, bundling is a practical compliance risk because it can render the underlying consent invalid even where a banner appears to collect agreement. If a user cannot accept strictly necessary or functional processing while declining advertising, the consent obtained for the non-essential purposes may not meet the specificity and freely-given standards regulators expect in most EU and UK contexts. This matters both for the lawfulness of the processing that follows under the GDPR and for the separate question of placing or accessing information on a device.

The treatment of bundling is not uniform across jurisdictions, and the acceptability of a bundled request depends on the applicable legal regime, the specific purposes involved, and evolving regulatory guidance. Australian regulators, for instance, describe bundled consent as a single request combining several requests to collect, use, and disclose personal information, and detailed treatment under specific US state privacy laws is outside the scope of this concept. Organizations should therefore treat unbundling as a general best practice while confirming the requirements applicable to their own operating jurisdictions.

Who it's relevant to

Privacy officers and data protection professionals
Those responsible for consent design need to assess whether cookie banners and consent flows offer genuine, granular choice rather than a single take-it-or-leave-it request. Bundling can undermine the specific and freely-given standards that regulators such as the ICO associate with valid consent, so unbundling by purpose is a common area of review.
Legal counsel and compliance teams
Counsel advising on cookie consent should weigh how bundling is treated under the applicable regime, recognizing that it is generally discouraged or not permitted under a number of data privacy laws but that acceptability depends on the specific purposes and jurisdiction. Detailed treatment under specific US state laws falls outside this concept and should be assessed separately.
Web developers and CMP implementers
Developers configuring consent management platforms typically need to implement per-category or per-purpose controls so that consent for analytics is not conditioned on consent for advertising, and vice versa. Correctly separating purposes at the technical layer supports the granular choice that most EU and UK guidance expects.
Marketing compliance teams
Teams deploying analytics, advertising, and functional cookies should understand that combining these into one bundled acceptance may invalidate the consent relied upon for non-essential purposes in EU and UK contexts, affecting whether the resulting data can lawfully be used.

Inside Bundled Consent

Bundling of Purposes
The practice of grouping multiple distinct processing purposes (for example, analytics, advertising, and personalization) under a single consent action, so that a user cannot accept or refuse each purpose separately. Under the GDPR, consent must be specific to each purpose, so bundling is generally viewed as undermining the specificity requirement in most EU jurisdictions.
Conditioning Service on Consent
A form of bundling where access to a website or service is tied to acceptance of non-essential cookies or processing. This overlaps with the concept of cookie walls and raises questions about whether consent is freely given, which is a core GDPR validity condition. The permissibility of such conditioning is contested and varies with guidance from individual data protection authorities.
Combined Consent Across Legal Regimes
Bundling can also refer to attempting to capture, in one action, both the ePrivacy consent required to place or access information on a device and the GDPR consent for subsequent processing of personal data. These are distinct legal bases under distinct instruments, and treating them as a single undifferentiated act can create compliance gaps because consent under one does not automatically satisfy the other.
Granularity and Affirmative Action
Valid consent in the EU must be freely given, specific, informed, and unambiguous, requiring a clear affirmative action. Bundled consent typically fails the specific element by not offering granular, per-purpose choices, and may fail the unambiguous element where a single click is presented as covering many purposes.
Scope Variation by Jurisdiction
Concerns about bundling are most pronounced under EU and UK opt-in frameworks. Under several US state privacy laws (such as the CCPA and CPRA in California), the model often relies on opt-out rather than opt-in, so the treatment of bundled choices differs and should not be assumed to mirror EU expectations.

Common questions

Answers to the questions practitioners most commonly ask about Bundled Consent.

Is bundling several cookie purposes into a single "Accept all" click a valid way to obtain consent in the EU?
Generally, no. Under the GDPR, consent must be specific, meaning it should be given for distinct processing purposes separately rather than bundled together. Where analytics, advertising, and other non-essential purposes are combined behind one undifferentiated action, data protection authorities in most EU jurisdictions have taken the position that such consent is not sufficiently granular. An "Accept all" button may be permissible only when it is offered alongside an equally accessible means to refuse or to make granular choices. The specifics depend on the design of the consent interface and evolving DPA guidance, so this should be assessed against current national implementations of the ePrivacy Directive and the GDPR.
Does agreeing to bundled consent for one purpose mean the user has also consented to unrelated processing?
No. A common misconception is that a single affirmative action can carry over to purposes the user was not clearly informed about or did not distinctly agree to. Because GDPR consent must be specific and informed, consent given in the context of one purpose does not automatically extend to unrelated or additional purposes. Each distinct purpose generally requires its own informed choice. Bundling unrelated purposes together risks rendering the consent invalid for some or all of those purposes. Note that requirements differ under frameworks such as US state privacy laws, which often rely on opt-out mechanisms rather than opt-in consent, so this analysis is primarily relevant in EU and UK contexts.
How can we separate purposes in a consent banner to avoid unlawful bundling?
A common approach in most EU jurisdictions is to present distinct consent options for each category or purpose, for example analytics, advertising, and functional cookies, so that a user can accept or reject them independently. This is often implemented through a granular preference layer, sometimes accessed via a "Manage preferences" or equivalent control that is as prominent and easy to use as any "Accept all" option. Strictly necessary or essential cookies are generally exempt from consent and typically do not require a toggle, though they should still be disclosed. The appropriate level of granularity depends on the purposes involved and current DPA guidance, which continues to evolve.
Can a consent management platform (CMP) automatically prevent unlawful bundling?
A CMP can support compliant consent collection by providing granular toggles, per-purpose logging, and configurable banner layouts, but it does not guarantee compliance. Whether a given configuration avoids unlawful bundling depends on how the CMP is set up, which purposes are grouped, and the design choices made by the organization. Tools support compliance but do not replace legal judgment. Organizations should review their specific CMP configuration against applicable EU, UK, or other requirements rather than assuming default settings are sufficient.
How should consent be recorded when multiple purposes are presented separately?
Where purposes are presented separately, consent logging or record-keeping should generally capture the user's choice for each distinct purpose rather than a single aggregate flag, so that the organization can demonstrate what the user specifically agreed to or refused. This typically supports the GDPR accountability principle in EU and UK contexts. The exact records to retain, including how granular they should be and how long they should be kept, depend on the organization's circumstances and applicable guidance, which this definition does not resolve.
Does the concern about bundling apply to technologies other than cookies?
Yes. The same consent considerations generally extend to similar technologies such as pixels, local storage, SDKs, and fingerprinting, because in most EU jurisdictions the ePrivacy rules govern the placing of and access to information on a user's device regardless of the specific technology, and the GDPR governs any resulting processing of personal data. Bundling distinct purposes served by these technologies raises the same specificity concerns as bundling cookie purposes. The precise treatment can vary by technology and jurisdiction, so it should be assessed against current applicable rules.

Common misconceptions

A single 'Accept All' button always constitutes bundled consent and is therefore automatically unlawful.
Offering an 'Accept All' option is not inherently the problem. The concern in most EU jurisdictions arises where users cannot exercise granular, per-purpose choices with comparable ease. An 'Accept All' button alongside genuine per-purpose controls and an equally accessible refusal option is treated differently from a design that forces all purposes into one indivisible action. Whether a specific implementation is compliant depends on facts and on evolving data protection authority guidance.
If a user consents to a bundle covering placement of cookies, that same consent covers all downstream processing of personal data.
The ePrivacy rules govern placing and accessing information on a device, while the GDPR governs the processing of any personal data that follows. Consent captured for one does not automatically satisfy the other, so bundling the two into a single act can leave the downstream processing without a valid, specific basis.
Bundling concerns apply the same way everywhere, so a global consent design will be compliant in all markets.
Obligations vary between the EU, the UK, and individual US states, among other regimes. EU and UK frameworks emphasize specific, freely given opt-in consent, whereas several US state laws rely primarily on opt-out mechanisms. A single design cannot be assumed lawful across all jurisdictions, and geographic scope should be assessed for each.

Best practices

Offer granular, per-purpose consent choices rather than a single indivisible action, so users can accept or refuse analytics, advertising, and functional processing independently where EU or UK law applies.
Separate the consent for placing or accessing information on a device (ePrivacy) from consent for subsequent processing of personal data (GDPR), and confirm each has a valid basis rather than relying on one bundled act.
Ensure that refusing non-essential cookies is as easy as accepting them, and avoid designs that condition access to the service on consent unless you have assessed whether such conditioning is defensible under applicable authority guidance.
Do not pre-tick boxes or infer consent from continued browsing in EU jurisdictions; require a clear affirmative action for each distinct purpose.
Map obligations to each jurisdiction you operate in, recognizing that opt-in expectations in the EU and UK differ from the opt-out models common under US state laws such as the CCPA and CPRA.
Keep records of what users consented to at the purpose level, and use a consent management platform to support (not replace) legal judgment, since tooling does not by itself guarantee compliance.
Promotional banner highlighting failures found in PCI audits and how to spot the gaps